Live preview
[Firm name]: AI Use Policy
Effective date: ________ Approved by: ________ Next review: ________
1. Purpose and scope
This policy sets how [Firm name] uses generative AI tools: which tools are allowed, what information may go into them, who checks the output and how that is recorded. It applies to all partners, employees, seasonal staff and contractors, on firm devices and personal ones, for all tax preparation and tax advice and bookkeeping and client accounting work.
AI tools can be confidently wrong. The professional who signs, sends or relies on the work remains fully responsible for it, whether or not AI helped produce it.
2. Who owns this policy
This policy is owned by the managing partner, who approves tools, keeps the approved tool list current, handles exceptions and incidents, and confirms that people are trained.
3. Approved tools
No AI tool is approved for client work yet. Until one is, AI may be used only for the general, non-client tasks in section 5, and never with client information.
- Before a tool is added, the policy owner confirms in writing: where data is stored, who can access it, whether inputs are used to train the vendor's models (they must not be), retention and deletion terms, and that the vendor can meet the firm's security program.
- Personal, free or consumer accounts of any AI tool, browser extensions and AI meeting note-takers are not approved for firm work unless listed above.
4. Client information
Client information is confidential under the AICPA Code of Professional Conduct (ET 1.700.001). Entering it into an AI tool is a disclosure to the tool's provider.
- No client information goes into any AI tool. That includes names, taxpayer identification numbers, account numbers, financial statements, source documents, client emails and anything that could identify a client.
- Staff may describe a situation in general terms with all identifying details removed.
- AI vendors that receive customer information are service providers under the firm's written information security program (FTC Safeguards Rule, 16 CFR Part 314).
- Recording or transcribing a client call with an AI tool requires the client's agreement first.
5. What AI may and may not be used for
Allowed, subject to section 6:
- Drafting internal emails, memos, checklists and training material.
- Summarizing public guidance, standards and articles, with every citation checked against the primary source.
- Explaining spreadsheet formulas and writing or reviewing formulas and scripts.
- Not allowed: letting an AI tool file, sign, send, post, approve or pay anything; relying on AI-supplied citations, figures or tax positions without verifying them; using AI output to skip a required review; using AI for decisions about people (hiring, performance, credit) without a person deciding.
6. Human review before anything leaves the firm
Any AI-assisted work that reaches a client, a tax authority or a financial statement is checked by the preparer and then reviewed by a second qualified person before it is used.
The reviewer checks that every source item is accounted for, recomputes amounts, traces figures and citations to source documents, and confirms that no step was taken without authority. Missing evidence is left open with an owner, not explained away.
For tax work this is the due diligence Circular 230 already requires (§10.22), and AI-generated projections, figures and citations used in written advice are verified independently (§10.37).
7. Recording AI use
When AI contributes to client work, a short note goes in the workpapers: the tool, what it was used for, who reviewed the output and the date.
8. Fees
Fees reflect the work actually done. Time saved by AI is not billed as if the work had been done by hand (Circular 230 §10.27).
9. Telling clients
Engagement letters state that the firm may use approved AI tools under this policy, that a professional reviews all AI-assisted work, and how client information is protected.
10. Training
Everyone covered by this policy completes AI training when they join and again each year, before busy season.
Training covers this policy, how AI tools fail (made-up figures and citations, confident wrong answers, missed items), and hands-on practice reviewing AI output. Completion is recorded with the person's name and date.
This supports the competence standard in Circular 230 §10.35 and the firm procedures expected under §10.36.
11. Mistakes and incidents
Anyone who enters client information into an unapproved tool, finds an AI error in work that has left the firm, or suspects a vendor problem tells the managing partner the same business day. Reporting a mistake promptly is expected and is not, on its own, a disciplinary matter. The firm then follows its information security incident procedures.
12. Keeping this policy current
The managing partner reviews this policy every year, and sooner when the firm adds a tool, a vendor changes its terms or new professional guidance is issued.
Acknowledgment
I have read this policy and will follow it. Name, signature, date.
Sources
Starting draft from cpaagents.ai. Not legal advice. Have the firm's counsel or ethics adviser review it, and check your state board's rules, before adopting it.
